Obfuscating data stored in a dispersed storage network

• US 8,683,231 B2
• Filed: 12/01/2011
• Issued: 03/25/2014
• Est. Priority Date: 12/27/2010
• Status: Active Grant

• Current Assignee: Pure Storage, Inc.
• Original Assignee: Cleversafe Incorporated (International Business Machines Corporation)
• Inventors: Grube, Gary W., Markison, Timothy W.
• Primary Examiner(s): NGUYEN, STEVE N
• Application Number:
  US13/309,432
• Publication Number:
  US 20120166907A1
• Time in Patent Office: 845 Days
• Field of Search: None
• US Class Current: 713/193
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/062 Securing storage systems
• CPC Class Codes: G06F 3/064 Management of blocks
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method begins by a processing module dispersed storage error encoding secret data in accordance with first dispersed storage error encoding parameters to produce at least one set of encoded secret slices and dispersed storage error encoding data in accordance with second dispersed storage error encoding parameters to produce a plurality of sets of encoded data slices. The method continues with the processing module determining an inter-dispersing function for outputting the sets of encoded secret slices and the plurality of sets of encoded data slices, and for a set of the plurality of encoded data slices: identifying at least one encoded data slice of the set of encoded data slices based on the inter-dispersing function, replacing the at least one encoded data slice with at least one encoded secret slice to produce a mixed set of encoded slices, and outputting the mixed set of encoded slices.

Claims

1. A method for execution by a computing device, the method comprises:

dispersed storage error encoding secret data in accordance with first dispersed storage error encoding parameters to produce at least one set of encoded secret slices;

dispersed storage error encoding data in accordance with second dispersed storage error encoding parameters to produce a plurality of sets of encoded data slices;

determining an inter-dispersing function for outputting the sets of encoded secret slices and the plurality of sets of encoded data slices, wherein the determining the inter-dispersing function including;

identifying a first decode threshold and a first pillar width based on the first dispersed storage error encoding parameters; and

identifying a second decode threshold and a second pillar width based on the second dispersed storage error encoding parameters, wherein the first decode threshold is less than or equal to a difference between the second pillar width and the second decode threshold; and

for a set of the plurality of encoded data slices;

identifying at least one encoded data slice of the set of encoded data slices based on the inter-dispersing function, wherein the identifying the at least one encoded data slice including identifying a number of encoded data slices of the set of encoded data slices as the at least one encoded data slice to be equal to or greater than the first decode threshold;

replacing the at least one encoded data slice with at least one encoded secret slice of the at least one set of encoded secret slices to produce a mixed set of encoded slices, wherein the replacing the at least one encoded data slice including replacing the number of encoded data slices with at least a first decode threshold number of encoded secret slices of a set of the least one set of encoded secret slices; and

outputting the mixed set of encoded slices.

2. The method of claim 1 further comprises:

the replacing the at least one encoded data slice with the at least one encoded secret slice including;

generating a slice name for an encoded data slice of the at least one encoded data slice; and

assigning the slice name to an encoded secret slice of the at least one encoded secret slice; and

the outputting the mixed set of encoded slices including;

outputting the encoded secret slice using the slice name of the encoded data slice.

3. The method of claim 1 further comprises:

the secret data relating to information regarding the data.

4. The method of claim 1 further comprises:

the secret data contains information that is unrelated to the data.

5. The method of claim 1, wherein the outputting the set of mixed slices comprises:

updating a directory regarding a set of slice names corresponding to the mixed set of encoded slices.

6. A method for execution by a computing device, the method comprises:

dispersed storage error encoding secret data in accordance with first dispersed storage error encoding parameters to produce at least one set of encoded secret slices;

dispersed storage error encoding data in accordance with second dispersed storage error encoding parameters to produce a plurality of sets of encoded data slices;

determining an inter-dispersing function for outputting the sets of encoded secret slices and the plurality of sets of encoded data slices, wherein the determining the inter-dispersing function including identifying a first decode threshold and a first pillar width based on the first dispersed storage error encoding parameters;

for a set of the plurality of encoded data slices;

identifying at least one encoded data slice of the set of encoded data slices based on the inter-dispersing function, wherein the identifying the at least one encoded data slice including identifying a number of encoded data slices of the set of encoded data slices as the at least one encoded data slice to be less than the first decode threshold;

replacing the at least one encoded data slice with at least one encoded secret slice of the at least one set of encoded secret slices to produce a mixed set of encoded slices, wherein the replacing the at least one encoded data slice including replacing the number of encoded data slices with less than a first decode threshold number of encoded secret slices of a set of the least one set of encoded secret slices; and

for a second set of the plurality of encoded data slices;

identifying a second number of encoded data slices of the second set of encoded data slices to be less than the first decode threshold; and

replacing the second number of encoded data slices with at least one other encoded secret slice of the set of the least one set of encoded secret slices

outputting the mixed set of encoded slices.

7. The method of claim 6 further comprises:

the replacing the at least one encoded data slice with the at least one encoded secret slice including;

generating a slice name for an encoded data slice of the at least one encoded data slice; and

assigning the slice name to an encoded secret slice of the at least one encoded secret slice; and

the outputting the mixed set of encoded slices including;

outputting the encoded secret slice using the slice name of the encoded data slice.

8. The method of claim 6 further comprises:

the secret data relating to information regarding the data.

9. The method of claim 6 further comprises:

the secret data contains information that is unrelated to the data.

10. The method of claim 6, wherein the outputting the set of mixed slices comprises:

updating a directory regarding a set of slice names corresponding to the mixed set of encoded slices.

11. A dispersed storage (DS) module comprises:

a first module for dispersed storage error encoding secret data in accordance with first dispersed storage error encoding parameters to produce at least one set of encoded secret slices;

a second module for dispersed storage error encoding data in accordance with second dispersed storage error encoding parameters to produce a plurality of sets of encoded data slices;

a third module for determining an inter-dispersing function for outputting the sets of encoded secret slices and the plurality of sets of encoded data slices, wherein the determining the inter-dispersing function includes;

identifying a first decode threshold and a first pillar width based on the first dispersed storage error encoding parameters; and

identifying a second decode threshold and a second pillar width based on the second dispersed storage error encoding parameters, wherein the first decode threshold is less than or equal to a difference between the second pillar width and the second decode threshold; and

for a set of the plurality of encoded data slices;

a fourth module for;

identifying at least one encoded data slice of the set of encoded data slices based on the inter-dispersing function, wherein the identifying the at least one encoded data slice includes identifying a number of encoded data slices of the set of encoded data slices as the at least one encoded data slice to be equal to or greater than the first decode threshold; and

replacing the at least one encoded data slice with at least one encoded secret slice of the at least one set of encoded secret slices to produce a mixed set of encoded slices, wherein the replacing the at least one encoded data slice includes replacing the number of encoded data slices with at least a first decode threshold number of encoded secret slices of a set of the least one set of encoded secret slices; and

a fifth module for facilitating outputting the mixed set of encoded slices.

12. The DS module of claim 11 further comprises:

the fourth module replaces the at least one encoded data slice with the at least one encoded secret slice by;

generating a slice name for an encoded data slice of the at least one encoded data slice; and

assigning the slice name to an encoded secret slice of the at least one encoded secret slice; and

the fifth module outputs the mixed set of encoded slices by;

outputting the encoded secret slice using the slice name of the encoded data slice.

13. The DS module of claim 11 further comprises:

the secret data relating to information regarding the data.

14. The DS module of claim 11 further comprises:

the secret data contains information that is unrelated to the data.

15. The DS module of claim 11, wherein the fifth module outputs the set of mixed slices by:

updating a directory regarding a set of slice names corresponding to the mixed set of encoded slices.

16. A dispersed storage (DS) module comprises:

a first module for dispersed storage error encoding secret data in accordance with first dispersed storage error encoding parameters to produce at least one set of encoded secret slices;

a second module for dispersed storage error encoding data in accordance with second dispersed storage error encoding parameters to produce a plurality of sets of encoded data slices;

a third module for determining an inter-dispersing function for outputting the sets of encoded secret slices and the plurality of sets of encoded data slices, wherein the determining the inter-dispersing function includes identifying a first decode threshold and a first pillar width based on the first dispersed storage error encoding parameters;

for a set of the plurality of encoded data slices;

a fourth module for;

identifying at least one encoded data slice of the set of encoded data slices based on the inter-dispersing function, wherein the identifying the at least one encoded data slice includes identifying a number of encoded data slices of the set of encoded data slices as the at least one encoded data slice to be less than the first decode threshold; and

replacing the at least one encoded data slice with at least one encoded secret slice of the at least one set of encoded secret slices to produce a mixed set of encoded slices, wherein the replacing the at least one encoded data slice includes replacing the number of encoded data slices with less than a first decode threshold number of encoded secret slices of a set of the least one set of encoded secret slices; and

for a second set of the plurality of encoded data slices;

the fourth module identifies a second number of encoded data slices of the second set of encoded data slices to be less than the first decode threshold; and

the fourth module replaces the second number of encoded data slices with at least one other encoded secret slice of the set of the least one set of encoded secret slices a fifth module for facilitating outputting the mixed set of encoded slices.

17. The DS module of claim 16 further comprises:

the fourth module replaces the at least one encoded data slice with the at least one encoded secret slice by;

generating a slice name for an encoded data slice of the at least one encoded data slice; and

assigning the slice name to an encoded secret slice of the at least one encoded secret slice; and

the fifth module outputs the mixed set of encoded slices by;

outputting the encoded secret slice using the slice name of the encoded data slice.

18. The DS module of claim 16 further comprises:

the secret data relating to information regarding the data.

19. The DS module of claim 16 further comprises:

the secret data contains information that is unrelated to the data.

20. The DS module of claim 16, wherein the fifth module outputs the set of mixed slices by:

updating a directory regarding a set of slice names corresponding to the mixed set of encoded slices.